{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:1c14172b-9cf6-5a8a-bb24-a738087ce923", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.3.3-tuxcare.4", "type": "library", "bom-ref": "pkg:npm/dompurify@2.3.3-tuxcare.4", "version": "2.3.3-tuxcare.4", "pedigree": { "ancestors": [ { "name": "dompurify", "purl": "pkg:npm/dompurify@2.3.3", "type": "library", "version": "2.3.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-16728", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:f6b4a47d-5041-5d46-957d-7be3ef82da76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-16728 affects version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2019-25155", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:c7b40526-114a-5390-bbe7-0041430cd309", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-25155 affects version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2020-26870", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:063fd292-9364-5d8e-9a98-542d9e1d11a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-26870 affects version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-45801", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:2354caf1-8e31-51e1-8a19-916f733665fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-45801 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-47875", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:6d08d79f-024c-5487-a3e4-72be09b4fcb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-47875 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2024-48910", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:1310f500-aece-5db5-843c-d0f03761729c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-48910 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2025-15599", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:732d9408-515c-55bd-adc8-2f6f78bf1b49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-15599 affects version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2025-26791", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:00cc7b5d-b4ed-5bc0-81b5-9a860cc382f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-26791 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-0540", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:794a94b5-359b-5d40-b84c-71db52bd1da7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-0540 affects version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116802", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:047a9233-3233-57f9-9f97-49e977333bad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116802 affects version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-116803", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:15e80b4a-6473-51e0-b14a-07c2c41fe6be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116803 affects version 2.3.3-tuxcare.4 of dompurify, and is fixed in 2.3.3-tuxcare.5." } }, { "id": "CVE-2026-116804", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:f1151945-2ba7-5a68-826a-75628e449bff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-116804 affects version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41238", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:d73fa7cf-6d89-500d-93a9-a8e4c1816086", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41238 affects version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41239", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:2f4f20bd-197a-5380-a9ca-4b1825dc2a91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41239 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-41240", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:c6cd149d-404b-59d8-82b4-fe7730c990af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41240 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-47423", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:7a6e133d-1c5f-5ddb-a284-d1d1b20677b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47423 affects version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49458", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:e7f0e7c6-a280-530b-8857-d057ec5d2144", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49458 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49459", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:1b03ccf7-6930-5471-aa5c-ff553be24cb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49459 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-49978", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:f5f1edad-fb02-5be9-8ebd-cb1165ec83ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-49978 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65898", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:884eaf67-bcfa-5c8b-8828-5475805554f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65898 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65899", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:aed501a2-20f7-58fd-914c-dfdc6e207d0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65899 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65900", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:e6342506-b4bd-5b61-af5c-f4f40df708f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-65900 affects version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65901", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:5e12eb18-e704-5f2f-98c8-6b71b527cf23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65901 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65902", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:9bcb6d97-e673-5151-99fc-ece8c1f07681", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65902 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65903", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:279d1673-b7dd-56c6-b02e-ddf7e99591f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65903 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65912", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:3459176a-7d48-534a-b732-1623b1646cae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65912 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65913", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:235dea72-463f-5508-94e7-63c7f37c3a08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65913 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-65914", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:1d5230ad-2999-5bc2-8d25-4e9125de8f29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-65914 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "CVE-2026-66010", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:1d46a7fe-8cf1-5ed7-af65-8f16ec0e6513", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-66010 does not affect version 2.3.3-tuxcare.4 of dompurify. not_affected \u2014 Version 2.3.3 is not affected by CVE-2026-66010. The vulnerability requires the CUSTOM_ELEMENT_HANDLING configuration feature, which was introduced in version 2.3.4. Version 2.3.3 predates this feature and therefore cannot process the attack input (HTML with custom elements when CUSTOM_ELEMENT_HANDLING is enabled). The vulnerable code path that allows custom elements to bypass afterSanitizeElem...", "justification": "code_not_present" } }, { "id": "CVE-2026-75838", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:2d259ffc-dddb-50e3-a45c-82ba27644d0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-75838 affects version 2.3.3-tuxcare.4 of dompurify, and is fixed in 2.3.3-tuxcare.6." } }, { "id": "GHSA-55q2-fjhq-7xh7", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:ae2b0718-ff30-5fc8-8b07-ae24bf8452a8", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-55q2-fjhq-7xh7 affects version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-6688-9rhm-gjv2", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:a41b8299-5bf6-5773-b84b-ad5382a83cd3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-6688-9rhm-gjv2 is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-c6gr-qvv4-5v3f", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:648aa233-d1d4-57cb-ac08-01f521d48684", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-c6gr-qvv4-5v3f is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-cg2g-xh64-v4q7", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:2751df9c-7fa4-5d3a-bebc-9208194bf60b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-cg2g-xh64-v4q7 affects version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-jxrp-r7gx-q4j8", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:acca4d11-f69f-59c4-b05a-9c8373bd6f11", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-jxrp-r7gx-q4j8 is a false positive for dompurify 2.3.3-tuxcare.4." } }, { "id": "GHSA-mjjq-c88q-qhr6", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:c5480220-8169-513c-bc4d-ae4271988512", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mjjq-c88q-qhr6 affects version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-mrv2-3pqr-j5jr", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:479712df-461b-56b2-8c63-7f49a5191fc6", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mrv2-3pqr-j5jr is fixed in version 2.3.3-tuxcare.4 of dompurify." } }, { "id": "GHSA-p98j-92pf-mc4p", "affects": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ], "bom-ref": "urn:uuid:4fe3bc92-365c-5312-9e2d-16119821f84b", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-p98j-92pf-mc4p affects version 2.3.3-tuxcare.4 of dompurify." } } ], "dependencies": [ { "ref": "pkg:npm/dompurify@2.3.3-tuxcare.4" } ] }